# CVE-2026-39380: Open Source Point of Sale Stored XSS in Stock Locations

Source: https://junglewise.ai/threats/cve-2026-39380-open-source-point-of-sale-stored-xss-in-stock-locations  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39380 · Severity: medium · CVSS 5.4 · Published 2026-04-07

Open Source Point of Sale is a web-based system used by businesses to manage sales, inventory, and employees. A security flaw allows an attacker with basic account access to inject malicious scripts into the system's stock location settings. When other staff members view the employee management interface, these scripts could automatically run, potentially allowing the attacker to steal login credentials or perform unauthorized actions on behalf of other users.

Technologies: [Opensourcepos Open Source Point of Sale](https://junglewise.ai/threats/technologies/open-source-point-of-sale). Vendors: [Opensourcepos](https://junglewise.ai/threats/vendors/opensourcepos).

## Quick answers

**Is CVE-2026-39380 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39380 being exploited in the wild.

**How severe is CVE-2026-39380?** Medium severity, with a CVSS score of 5.4, published 7 April 2026.

**Which products and versions are affected?** opensourcepos Open Source Point of Sale < 3.4.3.

**Is there a fix for CVE-2026-39380?** A patch was published on 2026-04-07. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39380 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-39380?** Check whether you run Opensourcepos Open Source Point of Sale. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in Open Source Point of Sale (OSPOS) prior to version 3.4.3. The vulnerability is located in the Stock Locations configuration feature, specifically within the 'stock_location' parameter of the '/config/saveLocations' endpoint. The application fails to sanitize user input before storing it in the database and subsequently fails to escape the data when rendering it in 'app/Views/employees/form.php'. An attacker with low-level privileges can inject a payload that executes when an administrative user views the Employees interface. This can lead to session hijacking, unauthorized actions, or phishing. The issue is resolved in version 3.4.3 by implementing proper output escaping using the esc() helper or htmlspecialchars.

## Affected products

- opensourcepos Open Source Point of Sale < 3.4.3

## Timeline

- 2026-04-07: disclosed
- 2026-04-07: advisory
- 2026-04-07: patched

## References

- [https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-7hg5-68rx-xpmg](https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-7hg5-68rx-xpmg)

## Related threats

- [OpenSourcePOS missing brute-force protection on login endpoint](https://junglewise.ai/threats/cve-2026-19895-opensourcepos-missing-brute-force-protection-on-login-endpoint)
- [opensourcepos Open Source Point of Sale path traversal in getPicThumb](https://junglewise.ai/threats/cve-2026-8802-opensourcepos-open-source-point-of-sale-path-traversal-in)
- [Open Source Point of Sale Stored XSS in Daily Sales table](https://junglewise.ai/threats/cve-2026-32712-open-source-point-of-sale-stored-xss-in-daily-sales-table)
- [Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter…](https://junglewise.ai/threats/cve-2025-68434-open-source-point-of-sale-opensourcepos-is-a-web-based-point-of)
- [Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter…](https://junglewise.ai/threats/cve-2025-68147-open-source-point-of-sale-opensourcepos-is-a-web-based-point-of)